Stop the hammering on your login screen.
Every Moodle login screen exposed to the internet receives automated login attempts. Usually invisible, until a weak password hits or the server buckles under the load. This plugin detects that pattern and shuts the door.
What you use this for
- Your logs are full of failed login attempts from the same IP address.
- A security audit asks for demonstrable brute-force protection.
- Your Moodle slows down at moments when no users are active.
- You want to know whether someone is targeting one specific account.
The plugins
Anti-hammering / Login blocker
Detects repeated login attempts and blocks by IP address, by username or by both. You define what counts as "too many".
auth_antihammer · GPL, free to use
12 releases since 2015 · Moodle 3.10–5.1
Good to know
- This protects the Moodle login screen, not your whole server. Network-level protection belongs in a firewall or WAF in front of it.
- Do not set the thresholds too low: a shared office IP can legitimately generate many login attempts.
- The plugin does not replace two-factor authentication; it limits how often someone may try.
Frequently asked questions
Does this block real users too?
It can, if the threshold is too tight. That is why the limits are configurable and blocks can be lifted manually. Start generously and tighten afterwards.
Does this work behind a proxy or load balancer?
Only if Moodle sees the real client IP. If there is a proxy in front, it must forward the original address, otherwise all traffic appears to come from one IP.
Need this to do something it does not do yet?
The plugins are open source and free to use. If you need a change, a migration or someone to keep them working across Moodle upgrades, that is what we do.
No obligation, no sales pitch. We advise first; a proposal comes later.
Other plugin suites
Coupon suite
Access and enrolment via coupon codes, including sign-up without a pre-existing account.
Payment plugins
Paid enrolments, paid activities and gateways for Mollie and PAY.
User lifecycle
Suspend, delete and restore accounts automatically, according to your own rules.
SMS gateways
Connect Moodle to an SMS provider for notifications and two-factor authentication.
Fonts
Your own fonts in PDF certificates and in the text editor, without touching core.